Remediation Cost Calculator
Cost a remediation campaign: engineering hours with testing overhead, downtime, tooling, cost per finding and FTE months needed.
Inputs
Total Remediation Cost
$226,600.00
Engineering Cost
$132,600.00
Downtime Cost
$54,000.00
Cost per Finding
$472.08
Engineering Hours
1,560.0hours
FTE Months
12.00FTE-months
Largest Cost Line
Engineering time — 1560 hours, or 12 FTE months
Step by step
Values used
Findings to remediate = 480 findings; Average engineering time per finding = 2.50 hours; Blended engineering cost = 85 currency/hour; Testing and change overhead = 30 %; Total planned downtime = 12 hours; Cost per hour of downtime = 4,500 currency/hour; Tooling and licence cost for the campaign = 40,000 currency
Remediation Cost
Engineering hours = findings × hours per fix × (1 + testing overhead). Total cost = hours × rate + downtime hours × downtime cost + tooling. Cost per finding = total ÷ findings.
Capacity conversion
FTE months = engineering hours ÷ 130, using 130 productive hours per person-month rather than 160 to allow for meetings, interruptions and leave.
Total Remediation Cost
= 226,600.00
Engineering Cost
= 132,600.00
Downtime Cost
= 54,000.00
Cost per Finding
= 472.08
Engineering Hours
= 1,560.0 hours
FTE Months
= 12.00 FTE-months
How it works
Two things make remediation cost estimates wrong in practice: forgetting the testing and change overhead, which is rarely below 25% for anything customer-facing, and costing engineer time at salary rather than at the opportunity cost of the roadmap work it displaces. The FTE-month output exists because budget approval usually hinges on whether the work fits the team you already have. Every remediation campaign competes for the same engineers as the product roadmap, and a cost per finding lets you argue for automation, golden images or decommissioning instead of brute force.
Formulas
Remediation Cost
Engineering hours = findings × hours per fix × (1 + testing overhead). Total cost = hours × rate + downtime hours × downtime cost + tooling. Cost per finding = total ÷ findings.
- testing overhead
- Uplift for regression testing, change paperwork and validation
- downtime cost
- Revenue or productivity lost per hour of outage
- FTE months
- Hours ÷ 130 productive hours per person-month
Capacity conversion
FTE months = engineering hours ÷ 130, using 130 productive hours per person-month rather than 160 to allow for meetings, interruptions and leave.
Frequently Asked Questions
How is Remediation Cost calculated?
Engineering hours = findings × hours per fix × (1 + testing overhead). Total cost = hours × rate + downtime hours × downtime cost + tooling. Cost per finding = total ÷ findings. Two things make remediation cost estimates wrong in practice: forgetting the testing and change overhead, which is rarely below 25% for anything customer-facing, and costing engineer time at salary rather than at the opportunity cost of the roadmap work it displaces. The FTE-month output exists because budget approval usually hinges on whether the work fits the team you already have.
Why does Remediation Cost matter?
Every remediation campaign competes for the same engineers as the product roadmap, and a cost per finding lets you argue for automation, golden images or decommissioning instead of brute force.
What values do I need to enter?
This calculator takes 7 inputs: Findings to remediate, Average engineering time per finding, Blended engineering cost, Testing and change overhead, Total planned downtime, Cost per hour of downtime, Tooling and licence cost for the campaign. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Why 130 productive hours per FTE month?
Because a nominal 160-hour month loses time to meetings, incidents, interruptions and leave. Using 160 is the most common reason remediation plans slip by a third in their first month.
How do I bring the cost per finding down?
Batch it. Patching a golden image, bumping one shared dependency or decommissioning a host clears dozens of findings for the price of one change, which is why cost per finding falls fastest when you stop treating findings individually.
You might also need
- Scanner False Positive Rate CalculatorCommonly used together
- Security Debt CalculatorCommonly used together
- Patch Window CalculatorCommonly used together
- Risk Reduction CalculatorCommonly used together
- Technical Debt Risk CalculatorCommonly used together
- Patch Priority CalculatorAlso in Vulnerability Management